Re:Our First Certificate Is Now Live
by weavie on Tuesday September 15, 2015 @03:37AM
(#10219426)
Surely you would at least need access to a relevant email address on that domain? How would you bypass that?
[ Parent
| on HN ]
He would need to be in control of that domain entirely. thecitibank.com is just an address that looks legitimate and is purchasable.
Ok, I understand.
On a slight side note he may not necessarily need to control the domain entirely, just have access to a privileged email address [1]
However, now it seems you won't even need access to an email address. What would stop someone creating a cert for the real citibank.com and using it for a MITM attack? How many people actually check the green bar?
[1] http://arstechnica.com/security/2015/03/bogus-ssl-certificat...
In the live.fi example, it sounds like Microsoft may have failed to prevent a random user from registering [email protected] as a personal account. Citibank probably won't allow a customer to get that e-mail address!